cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5823
Views
10
Helpful
8
Replies

IOS-XE 9800 SSH to APs

Johannes Luther
Enthusiast
Enthusiast

Hello wireless experts,

I understand, that the AP SSH access is configured on an "AP profile" level.

Typically (and best practice), the SSH access to the APs is not enabled:

AP Profile Name               : default-ap-profile
... Device Management : Telnet : DISABLED SSH : DISABLED

So what if I want to enable SSH access for a single AP for troubleshooting purposed?

Do I really need to create a new AP profile, assign it to a site tag and assign my AP in question to this site tag?!

First of all: This is disruptive as far as I know (AP rejoins WLC) ... secondly this is a litte bit of a configuration overload, just to temporarily turn on SSH access.

So is there any way to enable SSH on a "per AP" basis for IOS-XE (C9800)

1 Accepted Solution

Accepted Solutions

I understand, but that is why I asked.  I'm assuming you don't want to run debugs using the remote commands due to the format and other noise?  I just don't see why you would not just enable ssh to the profile and then disable it when you are done.  The other option is to have console connection to each of your ap's if you want to run those commands without having to toggle SSH on and off or change the tags.  I personally would just toggle SSH on and off, because its quick and I don't have to have the ap reboot.  I don't expect Cisco to change that feature as its baked into a profile.

-Scott
*** Please rate helpful posts ***

View solution in original post

8 Replies 8

jayage
Beginner
Beginner

Someone out there who can offer a more elegant solution to this issue?

JPavonM
VIP Collaborator VIP Collaborator
VIP Collaborator

No you cannot,

AP remote access is managed by the WLC, so basically is you're assigning an AP profile to the AP with SSH that is disabled, then you need to change it to enable, or move the AP to a different profile, there is no other way.

HTH

Scott Fella
Hall of Fame Guru Hall of Fame Guru
Hall of Fame Guru

What specifically are you trying to accomplish with ssh?  What commands would you use..."show <command>". What I have always done is just enable ssh on the current site tag and then remove it when I'm done.  There is no disassociation when making this change.

If the plan is to just run some show commands, then use the following:

 

terminal monitor
ap name <ap-name> remote enable
ap name <ap-name> remote command "show whatever"
ap name <ap-name> remote disable
terminal no monitor

 

-Scott
*** Please rate helpful posts ***

Hey @Scott Fella ,

I'm aware of the remote debugging of access points using the commands above.

However, not all use-cases are covered. Examples:

- Enabling specific debugs (example: debug traffic wired ip capture or debug capwap client qos)

- AP client tracing (although this may be enabled via the WLC as well)

There may be some more examples

I understand, but that is why I asked.  I'm assuming you don't want to run debugs using the remote commands due to the format and other noise?  I just don't see why you would not just enable ssh to the profile and then disable it when you are done.  The other option is to have console connection to each of your ap's if you want to run those commands without having to toggle SSH on and off or change the tags.  I personally would just toggle SSH on and off, because its quick and I don't have to have the ap reboot.  I don't expect Cisco to change that feature as its baked into a profile.

-Scott
*** Please rate helpful posts ***

Yeah, that's the consequence. Enable the SSH access for all APs during the debug time.

That is what I have done.. I have tried to enable it and then SSH then disable it, but that ends my SSH session right away.  I do have console to AP's that I do testing on, so that is my other option.  You can always request a feature and see if they implement it.

-Scott
*** Please rate helpful posts ***

jasonm002
Beginner
Beginner

OP is right, this is a feature of AireOS that needs to come back for the 9800.

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers